CVE Feed

    Dashboard / CVE / CVE-2018-1112

    CVE-2018-1112

    glusterfs server before versions 3.10.12, 4.0.2 is vulnerable when using 'auth.allow' option which allows any unauthenticated gluster client to connect from any network to mount gluster storage volumes. NOTE: this vulnerability exists because of a CVE-2018-1088 regression.

    Published:Apr 19, 2018
    Last Modified:Nov 21, 2024
    EPS:Apr 25, 2018
    EPSS Score:0.03253
    CVSS Score:8

    Affected Products

    Vendor
    Gluster
    Product
    Glusterfs
    Vendor
    Redhat
    Product
    Enterprise Linux
    Vendor
    Redhat
    Product
    Storage

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-287 Improper Authentication

    Related CVEs

    CVE-2023-26253 (CVSS 7.5) — In Gluster GlusterFS 11.0, there is an xlators/mount/fuse/src/fuse-bridge.c notify stack-based buffer over-rea…
    CVE-2022-48340 (CVSS 7.5) — In Gluster GlusterFS 11.0, there is an xlators/cluster/dht/src/dht-common.c dht_setxattr_mds_cbk use-after-fre…
    CVE-2018-14651 (CVSS 8.8) — It was found that the fix for CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, and CVE-2018-109…
    CVE-2018-14660 (CVSS 6.5) — A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_…
    CVE-2018-14661 (CVSS 6.5) — It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped…
    CVE-2018-10927 (CVSS 8.1) — A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use…
    CVE-2018-10923 (CVSS 8.1) — It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs s…
    CVE-2018-10904 (CVSS 8.8) — It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extend…
    CVE-2018-10913 (CVSS 6.5) — An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr re…
    CVE-2018-10907 (CVSS 8.8) — It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in …

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High